@Virus: "Google searches for koobworm are only turning up media reports that
implicate facebook and/or twitter.
When I look for "koobworm code analysis" or other varients I find
nothing.
Not even any hits from AV sites.
What exactly is koobworm?  What are alternate names does it have?
What exploit does it leverage?
Is there any posted code analysis for it?"
    @DLipmannospam: "From: "Virus Guy" <email_address>
| Google searches for koobworm are only turning up media reports that
| implicate facebook and/or twitter.
| When I look for "koobworm code analysis" or other varients I find
| nothing.
| Not even any hits from AV sites.
| What exactly is koobworm?  What are alternate names does it have?
| What exploit does it leverage?
| Is there any posted code analysis for it?
It isn't koobworm per se it is Koobface or facebook kind of backwards.  It is a worm 
affecting facebook users.
Dave
<url>
Multi-AV - <url> "
    @Virus: "<quote>
What windows vulnerability is used to get it onto the typical system?
Or is it a pure social-engineering trick -> ie "click on this and then
say yes to run it" ?"
    @DLipmannospam: "From: "lifetweaker" <email_address>
| lifetweaker had written this in response to
| <url>
| -
<quote>
| David, Koobface doesn't only infect facebook users; But infects users of
| myspace and twitter also. It's more like a social networking worm.
| As for how it enters the system. Koobface asks the victim to install a
| piece of software, once installed, koobface hijacks the vicitms system,
| stealing valuable information; at the same time koobface hijacks the
| victims "social networking" account.
Yes....   That's right.
Dave
<url>
Multi-AV - <url> "
    @DLipmannospam: "From: "Virus Guy" <email_address>
<quote>
| What windows vulnerability is used to get it onto the typical system?
| Or is it a pure social-engineering trick -> ie "click on this and then
| say yes to run it" ?
Social Engineering  the human exploit.
Dave
<url>
Multi-AV - <url> "
    @Virus: "<quote>
Ok, so it doesn't rely on any OS or browser vulnerability.
Has there been any code analysis for it?
I assume that it is served up by a server that detects the victim's OS
via browser identifier string.  What platforms is it known to deliver a
platform-specific version?
Does it serve up (or will it function properly) on a win-9x/me system?"
    @DLipmannospam: "From: "Virus Guy" <email_address>
<quote>
| Ok, so it doesn't rely on any OS or browser vulnerability.
| Has there been any code analysis for it?
| I assume that it is served up by a server that detects the victim's OS
| via browser identifier string.  What platforms is it known to deliver a
| platform-specific version?
| Does it serve up (or will it function properly) on a win-9x/me system?
I haven't analyzed a koobface in a couple of months.  I don't have an answer :-(
Dave
<url>
Multi-AV - <url> "
    @Virus: "<quote>
Is it really a worm?
If it gets onto systems by having users unwittingly download and then
answer "yes" to install/run it, then how can it be a worm?
If, once installed, it performs "worm-like" activities to spread itself
to other systems, then it must be trying to leverage some system-level
vunlerability -> which was stated earlier in this thread that it does
not do.
Some are calling it a worm.  Are they correct?"
    @jen: ""Virus Guy" <email_address> wrote in message 
news:<email_address>
<quote>
Koobface Tweets:
<url>
-jen "
    @Virus: "My understanding of a (computer) worm is that it's a program (code, etc)
that can place a copy of itself on another system (at least in such a
way so that it will be executed at some point) without requiring human
intervention.
Koob (or koobface) does not meet that definition of a worm.  
All it seems to do (once it starts running on a given system) is to post
a munged or obfuscated URL link in a public/visible forum.  The web
server behind the link serves up a copy of koob in a socially engineered
context that compels the user to willingly run the downloaded file.
It seems incorrect for various AV forums and entities to identify
koob/koobface as a worm.
It's not a worm, and it's not a virus.  It's really just a trojan.
I still want to know if it runs correctly on win-9x/me."
    @erratic: ""Virus Guy" <email_address> wrote in message 
news:<email_address>
<quote>
Clickworm not autoworm. Even friendgreet was called a worm - and *it* 
even had a disclosure in the EULA. "
    @DLipmannospam: "From: "Virus Guy" <email_address>
| My understanding of a (computer) worm is that it's a program (code, etc)
| that can place a copy of itself on another system (at least in such a
| way so that it will be executed at some point) without requiring human
| intervention.
| Koob (or koobface) does not meet that definition of a worm.
| All it seems to do (once it starts running on a given system) is to post
| a munged or obfuscated URL link in a public/visible forum.  The web
| server behind the link serves up a copy of koob in a socially engineered
| context that compels the user to willingly run the downloaded file.
| It seems incorrect for various AV forums and entities to identify
| koob/koobface as a worm.
| It's not a worm, and it's not a virus.  It's really just a trojan.
| I still want to know if it runs correctly on win-9x/me.
Contacted a "friend".
Yes, Win9x/ME is affected by Koobface.
The Koobface attempts to spread via the generation of "spam" messages from an infected 
user's MySpace and/or Facebook account to their respective contact list. Inside the 
spammed message is a malicious link to a location on malicious web site  If the spam 
recipient enganges the malicious link a Koobface variant will be downloaded.
Dave
<url>
Multi-AV - <url> "
    @Virus: "<quote>
But it _doesn't_ replicate.
It doesn't manage to place a copy of itself on another system in a
totally autonomous way.
It's basically a spam engine.  It sends URL's via e-mail to the local
contact list or it posts URL's using the local credentials or identity
to social networks or forums.
Can anyone here explain if a computer worm is supposed to be able to do
it's work without human intervention?
Does the transmission or posting of a URL qualify as a worm propagation
method?
The fact is that Koob doesn't have control over what is at the other end
of the URL that it's advertising.  The payload that is served up might
be quite different.  Isin't another characteristic of a worm is that
what ends up on the target machine is an exact duplicate of what's on
the source machine?
But there is no self-replication happening!
A trojan can examine the local address list of the machine it happens to
find itself on, and then e-mail itself as an attachment to recipients on
that list.  That is a more "worm-like" behavior than what koob seems to
do.  Human involvement is still required on the recipient end to launch
the attachment.
I would believe a web or net-published authoritative explanation or
answer."
    @DLipmannospam: "From: "Virus Guy" <email_address>
<quote>
| Is there a reason why such information would be (or is) not published
| anywhere?
It is.  You didn't look.
Dave
<url>
Multi-AV - <url> "
    @Virus: "<quote>
I did.
I did not find any credible statement saying that win-9x/me was
compatible with the koobface app that is (or has been) circulating.
So you resorted to a back-channel inquiry.
Apparently you couldn't find anything either eh?"
    @erratic: ""Virus Guy" <email_address> wrote in message 
news:<email_address>
<quote>
Yes, it does.
Correct, but it does copy itself (or has itself copied) and as such it 
does "replicate".
The fact of replication is separate from the method of replication. The 
fact of replication makes it a worm or virus. The lack of attaching the 
replicant to host code is what makes it a worm rather than a virus.
Unless you are one that views the virus as a superset of worms (all 
worms are viruses but not vice versa).
By some definitions, all worms are automatic worms (no user input 
required).
By some definitions, worms don't have to replicate (they need only 
exploit vulnerable software).
Yes, in fact the mere placing of a replicant in a shared directory 
(Kazaa worms) can have the same end result - and that which behaves as a 
worm is a worm.
<url>
True, it is simply a trojan when encountered - when executed it 
replicates and becomes many more trojans for the next encounter(s). 
Trojans are considered non-replicating malware, so this is a worm (no 
host program "infection" so not a virus - unless as above...).
Different segments of an overall program can be running on different 
machines and together constitute a worm program. Besides, with 
polymorphism "exact duplicates" are not common. More like a set of 
programs that exhibit the same or similar functional behavior despite 
the differences in the exact methods used to attain those results.
Yes, but I recall reading somewhere where Fred Cohen described his virus 
as "an interesting trojan". These days, once replication is part of the 
behavior, it is no longer termed a trojan.
<url>
...and a "copy" is made to attach to each e-mail - and the process is 
instigated by the malware itself.
Clickworm.
If it looks in the wrong places for security cookies, I suppose it 
wouldn't work. The rest of the needed environment seems to be there."
    @DLipmannospam: "From: "Virus Guy" <email_address>
<quote>
| I did.
| I did not find any credible statement saying that win-9x/me was
| compatible with the koobface app that is (or has been) circulating.
| So you resorted to a back-channel inquiry.
| Apparently you couldn't find anything either eh?
Hint  look at company library/encyclopedias.
Dave
<url>
Multi-AV - <url> "
    @Virus: "<quote>
No.
It does not place a copy of itself on the server that it advertises via
it's spam links or postings.
It does not place a copy of itself on the destination PC.
It _wants_ for a copy of itself to end up on other PC's (as does all
malware) but it no more puts that copy there than the typical trojan
does for itself.
No.  Who-ever controls the spamvertised server has put a copy of Koob on
that server.  When a new PC becomes infected, that copy came from a
server - not some other infected PC.
A worm does not require the use of a third PC when spreading from
machine 1 to machine 2.
Worms are not served.  Trojans are served.  Koob is a trojan.
Explain how I can have any form of malware end up on my PC _without_
replication.
Your use of the concept of "replication" is strange in this context.
The requirment for it to need a server to spread makes it a trojan and
not a worm.
sufficiently or clearly delineates it from either trojan or worm.
Only trojans and worms appear to have a few clear distinctions in terms
of how they spread and the level of operator intervention required.  In
that regard, a true worm can spread from PC-1 to PC-2 without the aid of
a third PC to act as a server and without the need for human activity or
action.  Koob is not such a worm.  
I asked if transmitting or posting a URL qualifies as a worm
transmission method.  You said yes, and then you immediately went on to
describe file copying to shared directories.  The two are hardly the
same phenomena.  So you'd better come up with a better answer because
that one didn't work.
Koob does not replicate itself.  It tricks people into downloading more
copies of itself from a server.  Koob requires a functioning server with
known coordinates in order to spread.  A true worm seeks out on it's own
the next destination PC and directly transmits a copy of itself to that
PC.  Koob does not do this.
Why are you so insistent on making a case that koob is a worm, to the
extent of stretching the definition of what a worm is?
Your answer was as clear as mud.  Please reformulate and restate your
response to that question.
Worms don't need polymorphism if they are leveraging an exploit that
sucessfully allows themselves to spread from one PC to the next without
human intervention."
    @Virus: "<quote>
Sorry, I didn't catch that.
Please explain again who the loud-mouth know-all pissant is.
And it looks like there was a posting slip-up - your reply to
microsoft.public.security.virus got switched with alt.usenet.kooks
(perhaps you are a follower of that group)."
    @erratic: ""Virus Guy" <email_address> wrote in message 
news:<email_address>
<quote>
Yes, it uses network replication (typical of many worms)
Could you give me an exact malware name for the malware we are talking 
about so that we don't end up talking about different things?
The ones I've seen do indeed serve the malware from the server.
True, but they take steps (programmatically) to enhance the probability 
that the victim user will do so.
True, but you seem to be stuck on the idea that all worms are automatic 
worms.
There is user controlled space on those (Facebook?) servers.
True again, but that does not disqualify the malware as being a worm
Who says?
As usual,you start out asking and end up telling.
I meant recursively replicating (since we are talking about worms and/or 
viruses I thought it was understood)
I will try to be more careful with my wording.
Wrong.
"Worms and viruses are both common types of self-replicating malware but 
differ in their method of replication (Grimes, 2001; Harley, Slade,  and 
Gattiker, 2001; Szor, 2005). A computer virus depends on hijacking 
control of another (host) program to attach a copy of its virus code to 
more files or programs. When the newly infected program is executed, the 
virus code is also executed. In contrast, a worm is a standalone 
program that does not depend on other programs (Nazario, 2004). It 
replicates by searching for vulnerable targets through the network, and 
attempts to transfer a copy of itself. Worms are dependent on the 
network environment to spread."
from
<url>
and...
"A computer virus is a self-replicating program containing code that 
explicitly copies itself and that can "infect" other programs by 
modifying  them or their environment such that a call to an infected 
program implies a call to a possibly evolved copy of the virus."
Many people use the term "true worm" to describe automatic worms. 
Nevertheless, the *other* worms do exist and will continue to be called 
worms. It is more about the resultant behavior than it is about the 
method used to achieve that end.
See "network replication". Here is an example from my Google search.
<url>
...and as such does recursively replicate without using a host program 
to do so.
Says who?
As with the virus, the replicant can be a "possibly evolved" or 
"morphed" copy rather than an exact copy.
They do if they want to avoid (or delay) detection. "
    @Virus: "<quote>
If there is going to be a distinction made today between what is a
trojan and what is a worm, then I'd make the case that the single most
useful criteria or requirement for a worm is that it can spread from one
machine directly to another without requiring an intermediate server,
and possibly that such spreading can be done without requiring human
assistance.
The most obvious mechanism is the exploitation of various netbios
vulnerabilities, followed by network shares (but note that placing a
copy of itself on shared directory of another machine does not garantee
that it will actually execute on that machine and spread further). 
Spreading via "sneaker-net" (auto-run exploitation on removable media
for example) would also qualify.
Any other mode of distribution that involves a third server machine
(where the malware is really hosted) would take it out of the realm of
being a worm and make it just an ordinary virus or trojan.
If you want to make the case that something can be a worm even if it
doesn't spread from one machine directly to another without requiring a
third machine to act as a server, then what else (in your opinion)
becomes the central characteristic for something to be called a worm?
I note that nobody else wants to venture an opinion or comment.  Not
even you - Lipman?"
    @erratic: ""Virus Guy" <email_address> wrote in message 
news:<email_address>
<quote>
First, let me thank you for snipping.
If a malware writer places a trojan where it can be downloaded and 
executed, this is a distribution method. If a program places trojans 
where they can be downloaded and executed, this is an automated 
distribution system. If the program doing the placing is the functional 
equivalent of the program being placed - it is a worm. Recursive 
replication is wormsign (unless it infects a host program with itself - 
in which case it is a virus). It doesn't matter how many stages the 
program goes through, or how many fragments there are running on how 
many different machines. As long as it eventually comes around to being 
a functionally equivalent new instance (at least twice), it can be 
considered recusively replicating - and a worm. A virus' copying itself 
is explicit, while the worms' can be implicit (network replication).
True, but I can just about guarantee that *someone* really really really 
must see the dancing pigs.
Even if the dancing pig displaying program has in its EULA that 
something else will happen that you would not approve of.
Some worms of recent past have actually shown that clickme.exe works 
just fine. I'm pretty sure malware.exe or don'tclickme.com would work 
too.
So, auto execution is your main concern? Put users back in the loop, and 
you have only attenuated the effect a little bit. Certainly there will 
be no "Worhol clickworms" - but having users involved like this is no 
real obstacle to a worm. To be sure, a virus may or may not involve user 
action in its cycle, so why put that restriction on a worm when 
infection already provides a dichotomy?
Actually - it takes it one step closer to being an octopus.
Central - it recursively replicates without requiring infecting a host 
program to do so.
David disagrees with the dichotomy, and prefers that all worms are 
contained within the "virus" set.
...funny, he seems fairly reasonable at other times  :o\
He strongly opposes trojans being called viruses because he favors the 
dichotomy there. If it doesn't recursively replicate, it should not be 
called a virus or a worm even though it appears as a trojan in some part 
of its lifecycle.
The subject has been talked to death, with very little consensus, over 
the years and that is not expected to change. "
    @not: "[worm or trojan]
<quote>
Perhaps because this kind of argument is not very interesting or
useful. More interesting to me are the technical details of what it
actually does when run. There are descriptions available on the web,
for example from Symantec and McAfee.
I have a copy of what is detected by several scanners as Koobface but
haven't analysed it in depth. I can tell you it's packed with UPX and
was written in VC++ 6."
    @Virus: "<quote>
I have only found very general explanations for what koob does.
Nothing specific, such as registry changes, changes to autorun, how does
it hook itself into a system, how does it hide itself when running, does
it interfere with other processes (AV, etc) running on the infected
system, what ports does it listen to, what additional payloads does it
seek out and download."
    @not: "<quote>
Symantec give those details but they are rather old:
<url>
I now realise that I've already examined this critter without knowing
what it was. The variant uses different file names but sets the
"HKLM\...\run" registry key so as to restart itself. It also does not
delete itself if no social networking sites are found in the user's
cookies, nor does it pop up a message box.
In the variant I checked, information (login details, email addy) is
harvested from cookies pertaining to:
 hi5.com
 facebook.com
 netlog.com
 twitter.com
 tagged.com
 bebo.com
 myspace.com
It just runs as a normal executable started by the user or from the
"run" key.
It doesn't.
This one doesn't appear to.
None. It downloads instructions on what to do from a list of sites
in the executable by sending HTTP POST requests and recieving data
through raw socket connections. If a site fails it tries another. If
it can't connect to any it sleeps and retries until successful.
Depends on what's in the configuration data (gen.php). Typical text
looks like this:
#PID=8000
STARTONCE|<url> to malware].exe
STARTONCE|<url> to malware].exe
WAIT|60
START|<url> to malware].exe
STARTONCEIMG|<url> to malware].jpg|[key to decode exe from jpeg]
#BLACKLABEL
EXIT
Other commands can be:
BLOCKIP
BASEDOMAIN
STARTIMG
UPDATE
RESET
BLOCKIP runs: "route add -p %s mask %s %s metric 3"
where %s represents parameters.
Most of the commands download and run other malware and from a quick
inspection of some, they in turn download yet more. Embedded in one is
what looks like an IP filter driver. I can also see strings that
suggest hijacking of search engine results."
{'source': 'USENET', 'other_information': '{"reply_count": 24, "forum_name": "alt.comp.anti-virus.20140912.mbox"}', 'file': 'data/output/usenet-alt.comp.parquet'}